The vulnerability CVE-2025-30895 affects the magepeopleteam WpEvently plugin up to version 4.2.9. It is caused by improper limitation of a pathname to a restricted directory, leading to a path traversal issue that allows PHP Local File Inclusion. This flaw can be exploited remotely with high attack complexity and low privileges, without requiring user interaction. The CVSS v3.1 base score is 7.5, indicating a high severity with potential impacts on confidentiality, integrity, and availability of the affected system. No patch or vendor advisory has been provided to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker to include and execute arbitrary local files on the server running the vulnerable WpEvently plugin. This can lead to full compromise of the affected system, including unauthorized disclosure, modification, or destruction of data, and disruption of service. The high CVSS score reflects the significant impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable WpEvently plugin to mitigate risk. Monitor official magepeopleteam communications for updates and apply patches promptly once available.